The vulnerability arises from an oversight in the Linux kernel bonding subsystem. When a native XDP program is attached to a bond interface operating in 802.3ad or balance‑xor mode, the system permits the xmit_hash_policy to be changed to vlan+srcmac even though the existing XDP program would no longer be compatible. This mismatch leaves the bond still holding a reference to the XDP program, and when the bond is later destroyed the kernel attempts to uninstall the incompatible program. Because bond_xdp_check() rejects the configuration, dev_xdp_uninstall() triggers a WARN_ON and returns -EOPNOTSUPP, potentially leading to a kernel warning or instability. The vulnerability therefore can cause service disruption or a denial of service through kernel panics or crashes, but does not provide a direct remote code execution path.

Affected systems include all Linux kernel implementations that support bonding, 802.3ad, and balance‑xor modes with XDP. The vulnerability applies to Linux kernels that have not yet incorporated the fix contained in commit 39a0876d595b. No specific version ranges are listed, so any kernel prior to the application of that change may be impacted.

The CVSS score of 5.5 classifies the issue as moderate severity, and the EPSS indicates that the likelihood of exploitation is very low (under 1%). The vulnerability is also not listed in the CISA KEV catalog. Exploitation requires local privileged access to configure bonding options and attach an XDP program, so the attack vector is local. Because the flaw is limited to kernel configuration and does not provide remote code execution, the overall risk to an organization is moderate and primarily dependent on whether the affected infrastructure relies on the vulnerable bonding configuration.